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On-Screen Navigation 



• At the bottom of the screen is your progress bat you will be able to pause 
slides or exit the training at any time. 

« -New" and "Previous" buttons are available for navigating between, slides. 



• Throughout the training there will be buttons or other Interactive elements; 
wherever possible we have changed trie mouse posntei or otherwise Indicated 
where to click within ttiepage in order to progress, 

■ At the conclusion of training you will complete a short quiz to review the cortcepts 
we have covered today. 
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Overview 



For the 201 3 NSI Annual Refresher training we will be going back to the basics. 
The following will be covered: 

■ An overview of the NSI Program, classification levels, and liow to access, 
classified information. 

■ Safeguarding classified information to li id jde protection requirements for 
review, discussion, storage, transmitting/transferring, reproduction and 
destruction, 

■ What to do IT you receive classified information in the mall or by courier and how 
to send classified information to another recipient, 

■ What to do if a security incident, involving NSI. occurs. 

■ Throughout the training there are knowledge checks. At the end of the training, 
you will take a short qui? to test your knowledge. Vou will receive a certificate 
once you pass the quiz. 

■ IF you choose the wrong answer you must click on the "dear" button to reset the 
,m:,wH dVMiv before trying again 
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NSI Program Guidance 



There are three guiding principles when it tomes 
to ERA'S National Security Information (NSI) 
Program. 

- Executive Order {E.G.) 1 3526: Prescribes 
the system for classifying, safeguarding, and 
declassifying MSI. 

■ Information Security Oversight Office 
(BOO) 32 CFR 2001: Sets forth additional 
guidance for the NSI Program at EPA, 

• EPA's NSI Handbook: Incorporates and expands 
on the guidance from E,0. 11526 and iSOO 32 
CFR2O01 for the agency. Official document for 
EPA employee* (federal and non- federal) that 
outlines the standards and procedures to be 
followed, 



1 



i 1 




N3P-3!jrmtTwni 
lt-:2tO-5M-1*J 

MSI P >ji miiFn-j -i-lri.* IJ-K 




2 of 27 



NSI Annual 2013 



2/20/2014 



Slides 



it; 



Whatis"NSl"? 



NSI, which stands far National Security information, Is also referred to as classified 
information. 

NSI is any government information thai could reasonably be expected to result in 
d image to rite national security of the United Stales should unauthorized disclosure 
occur. 

Per EO 13526, there are eight fS] categories used by an original classification authority 
to determine whether information should be classified. We will go over those 
categories on the next slide. 



Remember: ONLY the Administrator is authorized 
to make original classification decisions. 
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Whatis"NSI"? 

The eight categories under which Information may be classified are; 

(a) Military plans, weapons systems, or operations 

(b) Foreign government Information 

(c> Intelligence activities (including covert action), sources, methods, or cryptology 
(d) Foreign relations ot foreign activities of the United States 
(e| Scientific, technological, or economic matters relating to national security 
(fl United States programs for safeguarding nuclear materials or facilities 

(g) Vulnerabilities or capabilities of systems., installations, Infrastructures, projects, 
plans, or protection services relating to national security 

(h) Development production, or use of weapons of mass dest ruction 
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Classification Levels 



There are three levels of classification, each of which carries a penalty should 
unauthorized access occur: 



• Top Secret: information that if disclosed 
could cause exceptionally grave damage 
to our national security. 

■ Secret; information that if disclosed 
could cause serious damage to our 
national security. 

* Confidential: information that if 
disclosed could cause damage lo our 
national security. 



M5IP-3grmtTwni 
lh:.Zt-2-5M-1963 
N3.P- yqr-awT** 



ru* :tcm\ 




Slide8 



Knowledge Check 1 



How many categories of information are thereto choose from when 
determining what kind of information is and is not potentially classified? 



Ale 
B}5 
• 0 8 

Dj There ire no categories,. I decide what is and isn't classified. 



NSIP-jgrjrttTwni 
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Corwcl-Thw^wdoht «i*gofl«tfui thr 
original cl dislocation Authority can use to 
determine wlwthvw at nol Information 
(;rtvi.»iKHi»/fonl* .i«jcim> Click here to 
Click here le cor try again. 
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Knowledge Check 2 



True or False: "Sensitive But Unclassified" is an appropriate substitution for 
national security information classified at the Confidential level. 



True 
• False 



MaP-^qrmtTtflm 
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Coma- hMlonil wturlty irtfcrmMlon cltsMfted 
at the Confidential level must be marked 
Ccmfidemt|.)F.Tcp Secret, Secret *nd 
Confidential «i*1h* wnly el*<.tifi(»[>iirt li>vr>k 
Irnt coin Ik mud lc- mari r Ctidt here to 
■ntormaiion. Click here try again. 
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Accessing Classified Information 



After completing the initial security briefing, and signing the Classified Information 
Nondisclosure Agreement tSF 312}, your clearance is official. However, In order to 
access classified information there Is one more piece you must have. 



In addition to your clearance, you must also have a need- to- know In order to 
a<cess classified Information. 

tf you and I haw the same clearance level but work on different classified projects, I 
do not have a night to access the information you are working on or with. No one 
has a right to access classified information based only on l heir job title, duties, or 
clearance level. 



Remember: Appropriate Clearance Level + Need-to-Know = Access. 
Noons has a right to access based solely an their position, title, or 
clearance JeveA 
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Safeguarding Classified Information 

In this section we will cover how we safeguard and protect classified Information from 
unauthorized disclosure, 



All work that involves classified information must take place in a secure area, let's 
discuss the types of activities that may Involve classified information First and then we 
will discuss secure areas In more depth 



Activities that may Involve classified Information are: 
> Discussion and/or Heview, 
■ Storage In GSA approved security containers. 

* Processing only on approved classified computers. 

* Reproduction, 



- Destruction. 



HSiP-jqrmtT»*ni 
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Safeguarding Classified Information 

The class Ifted operations identified on the previous slide may only take place in rooms 
that have been accredited. There are two types of secure areas: open storage and closed 
(or secure) storage. 

• Closed Storage: The typical room accreditation type found at EPA, Closed storage 
requires all classified infor mation to be appropriately secured when not in use. 



■ Open Storage: These rooms require add illonal security measures beyond those 
for dosed storage. Open storage allows users to leave classified Information out 
and is typically associated with rooms accredited for processing classified 
information on classified computer systems. 



Your NSI Representative can assist you with locating accredited 
spa ces. at you r location and provide you with an orientation for 
each space that you are authorized to access. 
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Knowledge Check 3 



You have a Top Secret clearance and are authorized to work on Project Alpha; 
your friend also has a Top Sec re [clearance and is authorized to work on Project 
Beta. Because you both have clearances at the same level, do you have a right 
to access Information related to each other's projects? 

A) Yes. wohaveihte same tle-jiarjce levels. 

■ BJNo, we do not have a need-to-krvow for the information related to the 

other's prgj«ct- 

O My wofk requires I use classified information, regardless of project 
relevance, which is all that is required far me to nave access. 

D'l Yes. because my friend has access and is willing to let me look at 
documents, that means t tan look. I might be able to solve a, 
problem she's run into with Iwr current work 



HHP ^qwrtlTNni 

it-:3c-2-aM-i-»3 

P'vy>*H|r*j iyn 



Carted - both tlw appropriate dearanw lew! and • 

need-ta-know an? required to access classified 
Information Mo orw rusa right to acorn t Uisrfied 
*ifc*mi«ionlsa«d*Qk(^ijponr CHcfehereto 
or elMr^nft level. CPictht-r try again. 
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Knowledge Check 4 



From the list provided, choose four classified operations that may take place in 
a secure room. 

A.i Canvassing 

*? G) Reviewing 

Q Processing 

■ Di Destruction 

Fi fWussiar 
F) Breakdown 



Correct • Discussion. Review, Processing and Destruction, 
along with Reproduction are the operation* authorized 

for tenure wrm Rerrvember. not all rooms ire 
accredited for all operations. Always review the standard 
operating procedure for each secure area to ensure you 
are conducing operAtiarts a utriorii Click here to 
Cftck here to coritinu t ry again. 
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Standard Operating Procedures 



Regards ss of which type ot secure room (open or 
closed storage}, your NSI ftepr eserl tative wfl I have 
developed Standard Operating Procedures (SOPs) 
for that room- 

SOPs outline the expectations of each clearance 
holder using the s pace, as wel I as t he specific 
classified operations that are authorized to take 
place with In the foorn. 

For Instance, an SOP for a room authorized for 
discussion of classified Information will Include 
steps that must be taken to preclude 
eavesdropping, such as turning on the white noise 
machine, etc 




Remember: If the SOP expressly pro h i bi ts or does 
not identify a specific operation, do not do it. 



MSIP-jgrmtTtani 
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Review and Discussion of Classified Information 

The SOPs developed try your NS| Representative may have specific procedures identified 
for reviewing and discussing classified information Within an accredited secure room. 

Regardless of classification level, key points to keep in mind when reviewing 
and/or discussing classified Information include: 

• Be aware of your surroundings; (here rnay be others working within the secure area 
Who do not have a need-to-know. 



* Where available, use the white-noise machine to mask classified discussions. 

* Do not attempt to talk over the sound of the white noise machine. 



Remember Reviewing and discussing c&assifred information 
may only take place In an accredited secure room. 
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Storage of Classified Information 

Within the secure room (open or dosed storage), there are several features you 
should be aware of and know how to recognise. These features provide additional 
protection for classified information. 

Let's start our safeguarding discussion with security containers, There are severaf 
common features you can use to identify If the container you are looking at is 
approved for classified storage; 



GSA Approved 

Type 5 or 6 (Letter or Legal) 

Electronic* High- security locktsj 

Security Container Checksheet (SF 702) 
on outside of container 

Open/closed magnet on outside of 
container 




MSlP-jgfjmTwni 
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Remember: I f a security container H not loca ted within the 
secure space, do not leave classified information in the room. 
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Storage of Classified Information 

As we just mentioned, the security container must have an SF 7C2 on the outside to 
be an authorized srorag e location for classified information. 

SF /02s must be completed each tune you unlock or lock the security container. 



There should be an SF 702 in place for 
each draw« of the security moraine 
that has Us own lock. For <r 
security container has five 
a lock on each drawer, ther 
SF 702 attached to the out 
drawer. 




M* i ttDM-Up 
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Storage of Classified Information 

Mow that you can recognize a security container based on Its externa! features, how 
do you actually access the container itself? 

F irst, sane features of the locks: 
■ The locks are- digital. 

• They must be either the X-07 or X-CW model. 

* The combination for the security 
container is classified at the level of 
Infer mat Ion stored within the drawer. 



HaP-.2qrjHlTwni 
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Knowledge Check 5 



From the last provided, choose Four features; shared by all security containers: 



* A) GSA approved label 
. E) Five (5} drawers 

- Q Manual dlat lock 

* 01 Security Contasner Checkslreet 

E] High security digital {electronic) kick 
*" F) Op*r»/Closed magnetic sign 



Coired - All security container! a uthurlzed lo store 
classified information will be located in secure rooms 
and must have a GSA authorization stjeter an the front 
of the container a high security digital lock or locks; an 
open/closed magnetic ilgn; and. Midi drawer *witii a 
bck mutt haw It* own S«urity Container Chwkjheet 

[SFTWaflTitedtod^ourtsideofTh Q,;,. ner5 to 

try again. 



l.frr- T;j .. 1 . itlnuf- 
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Storage of Classified Information 

Now let's go over the key points of the. security container combination: 

• The combination must be memofized. Classified combinations cannot be 
stored in your watlet, at your desk, etc. 

■ Given only to those who need-to-know. 

■ Combinations must be changed: 

» Whenever you bring a new container into service or take an old one out 
of service. 

* Whenever an individual no longer requires access to the container. 

* Whenever the container is compromised. 



Remember: 

Memorize, don't compromise! 



W9 P^gr^m T&?nn 
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Storage of Classified Information 



We've covered the external markings that identify a security container and how to at cess 
the security tonal ner. Let s covet a coupie itemi you should find inside the security 
container. First, the Secure Container Information Form (SF 7001. 



This form is the only authored method for 
recording classified combinations. The top 
sheet of the form Is unclassified, □nee' the 
combination has been recorded and sealed 
inside the envelope the envelope becomes 
classified and must be protected accordingly. 



The envelope m ust be stored in a separate 
container (or drawer, if there are multiple 
locks) For safeguarding, 




H3F>-=igr*mTwin 
l!-:iCO-5M-1«J 



1 1 of 27 



NSI Annual 2013 



2/20/2014 



Slide23 



Storage of Classified Information 

The second item you wlli find tnstde the security container is the Drawer Inventory Log, 



As its name suggests, the Drawer inventory 
Log is used to inventory the contents of the 
security container drawer. Each drawer of 
the security container must have Its own 
log. The room owner Is responsible for 
maintaining the drawer inventory unless 
otherwise assigned. 



If the drawer It owned by a different 
program office or regional component 
they must assign an appropriately 
cleared individual, with need-to-know, to 
act asthe drawer Inventory custodian. 



1, 



t-~ » i-T^r 
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Knowledge Check 6 



True or False: Writing the security container combination down and keeping It 
under your keyboard is OK because no one ever looks there. 



True 
• Falw 



HEIP-3qrmtT»™ 
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C«T«r - CUsslft«t cwnNrwtlervt, fwsi twdk 
and/of Pi IV numbers may only be written 
down on Security Cantiiner mtamutlon 
Fof m» tSf ?0O»), Ttiew »nt th*n Uered rn * 
srparalr security ccttUlnrf, « drawer, to the 
ens the combination appl Gick here to 
certiinii- try again. 
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Storage of Classified Information 



At the end of the day, thg Activity Security Checklist |5F 701) must be completed if 
you have a security container The SF 701 will be stored at or near the entry/exit to 
the secure area. The SF 701 is a reminder to: 

■ Check the secure area for classified that may still be out 
(extremely Important for dosed storage areas); 







check tha t the sect w . VtfM — . . . 





■ And any other step 
spate. 

For secure areas that a' 
security container, thl 
time of access. 




■ J |'|" 'J >mUf 
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Transmitting/Transferring Classified Information 

Let's move on in our discussion and talk about transmission of classified Information. 
There are several ways in wtifch this can be accomplished; 

* secure telephoned fax 

■ Classified computer system 

* Mail service 

* Hand carrying/couriering 



These methods will be discussed 
further in the corning slides. 



MS. 




V 



you have questions regarding how to transferor transmit 
classified information, please contact yourNSI 
Representative or the NSf Program Team. 
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Secure Communications 



Our fi rsttransml ssion method is seen re telecom m unicatlons.Th is blan ket categoi y 
includes conversations over classified, or secure, telephones and data transmission 
Via suture fax. 



An y ti m e a elassi ried conversation needs 
to take place over the telephone, it was! 
be carried on (in a secure area over a 
secure phone. The secure phone comes 
in two parts 

• Secure Terminal Equipment {STE) 

• Cryptographic (Crypto) Card 



Remember; Do not leave (he Crypto Card in the 
STE unless specifically told otherwise. 




w 



ami own At on* [o j« j clew-up. 
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Secure Communications 

For transmitting data via a secure fan machine you need the following equipment: 

• Secure Terminal Equipment (STE) 

* Cryptographic (Crypto) Card 

■ Approved fax machine 

To send/receive a classified fax, the fax machine 
fe connected to the STE and uses the STE* 
encryption capabilities, 

only Tax machines specifically Identified for use 
with classified Information and located within t 
secure area are authorized tar transmitting a 
classified fax. 
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Secure Communications 



tmsy tiesttfflaiFirjdditftfa mailt taqpctastiied flrfarmatlon securely involves classified 
computer, jfrfhayianly take place In a secure area with 
computers specifically designated For processing by 
the MSI Program Team al or up-to a specific 
classification level. 

Processing up to the Secret level may onlytake place 
on Homeland Secure Data Network (HSDN) terminals. 

Processing above the Secret level may only lake place 
on Joint Worldwide Intelligence Communication 
System (JWICS} terminals. 

To access authorized systems, you must have the 
appropriate clearance and submit a justification 
along with the applicable account request form to 
the NSI Program Team. 

HSPN and JWICS computer system hardware and attached 
peripherals (Le h printers,, scanners, etc.) will always be clearly 

Remember; EWs network b Unclassified, No processing 
Nsip-aqr«rtiT(an of classified informBtiwt mey U ke place on EPA's network, 

I H2C-.2-S 64-1903 
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Secure Communications 



Individuals with access to classified computer systems have additional responsibilities with 
regards to the systems and information residing on those systems including: 

■ Only allowing individuals with HSONor IW1CS accounts to access tlx>se systems 

* Monitoring the HSON or JWICS system and the accredited space for suspicious 
behavior or conditions that may indicate tampering or attempts to gain access to the 
system, 

* Locking the- system when the computer Is unattended, even momentarily 

- Never using removable media with HSDN or JWICS, unless specifically authorized by 
the agency system owners. 

* Preventing unauthorized Individuals from Interacting with an HSDN or JWICS terminal 
to Include using the mouse and keyboard while the system Is live. 
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Secure Communications 



in addition to protecting the systems, as an authorized user you must also protect your 
access credentials. Tin? following steps are recommended: 

' Create a strong password and protect it at the level of the system that you have 
access To. 

* Strong passwords include the use of upper and lower i_d be letters, nuinbers, 
and special characters. 

* Phrases that use a mixture of characters are stronger than single words, (i.e., 
110v3$3cur!ty is stronger than $3cur!ly> 

* Do not reuse passwords from unclassified systems or programs urn a classified 
system. 

■ Passwords may be written on an SF 700 and stored in an approved GSA security 
container at the appropriate classification level. 

■ Do not allow anyone to view classified information available on HSDNorJWTCS 
without an appropriate clearance and a need to know for the level of the 
Information. 



lh:I(-2-SM-19tt3 
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Secure Communications 



As an authorized user, the Following guidelines must be followed when printing documents 
fromHSDNorJWlCS: 

* Ensure all classified documents are cleared from the printers "queue" before logging 
off or shutting down the computer If there are jobs pending in the queue they must 
be completed before I oggl ng off or shutting down. 

* Do not leave classified documents on the printer. 

■ Ensure all printed documents have the appropriate-classified covershee! attached 
to the front of the document and are placed In a GSA-approved security container 
If they will be retained; you must also update the Drawer Inventory Log, 

* For documents printed from JWIC5 that are classified as Top Secret or that contain 
Sensitive Compartmented Information, an EPA Form 1 3S0-2 must be completed to 
document destruction, prior to shredding the material, A witness must he present 
for destruction of these documents. 

■ Documents classified at Secret and be low do not require an EPA Form 1350-2 
be completed specifically to document destruction. 



lh:JW-SM-1963 



If you, haw questions regarding dassrfied computer systems, 

please fori tact your NSi Representative or the NSI Program Tearr 
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Knowledge Check 7 



True or False: 1 1 is OK to leave the crypto ca t d in the secu re term i na I eq ui pment 
(STE), despite what is stated in the SOP. 

True 



Comet • Unl«s thr room ii tceredlttd for open 
storage, the crypto carol mutt be lodt*^ ffi tlie 
•Hfturlty container wtiert not In u* if it H to 9* kept 
in the vupt iwm At the S.TE. B«* pf Mike Is to loci 
the crypto card in the i*curity container, when not 
In uic-. regaidleis ni accrc-d'taticr £Htk h er g f 0 
cwiHtm*. try again. 
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Knowledge Check 8 



True or False: Classified information maybe sent over EPA's unclassified 
network. 



TfUP 

• False 



KI5IP-=qrmtT»™ 
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Correct - Only umImMmI information m»y be sent 

ovef EPA'i network: Speai to yn«jr NSI 
Repreientahv* and/or the NSI Program Team about 

ivill*bte options if yeii needle Qckhereto 
informwion. Click henr i ■ try again. 
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Reproduction & Destruction of Classified Information 

There are two more processes to be aware of when it comes to safeguarding classified 
information - reproduction and destruction. 



Both reproduction and destruction must take 
place in accredited secure areas on equipment 
that has been expressly d eslgnated for use with 
classified Information. 

tot destruction, keep the following in mind: 

• The MSI Program Team wi II determine if a shredder 
make/model is authorized for destruction of 
classified Information. 

* Shredding using high-security cross tut 
shredders Is the only approved method for 
destruction at EPA. 



I — 



Destruction ofTS requires a Wtnmj 



NSI P-jgrjni Twin 
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Re m em ber: Approved shredders and 

copiers, will have an authorization 
certificate affi on/near the madi ir»e- 
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Receiving Classified Information by Mail 

There may be occasions when receiving classified Information over encrypted means is 
not possible. For these in stances classified information may be mailed or hand delivered. 
We'll discuss these two concepts in more depth now. 

There are certain requirements which must be met 
depending on the level of the classified Information that is 
being sent through the mail or by courier. 



Top Secret information may 
only be transmitted dinKlfy 
hwi pawn to-person, at no 
lime may * b* mailed or 
ihipperi 

Top Srciel'nfDr'njlinn may 
flJiabeLranHliiLl«d vii 
electronic means mm try 
appiavmS secure 

cemmuAk^bfiiu syiiemfl.t, 

/wicsi 



Secret uifnrrnjlion miyba 
LTjiisrtutted slnkliriy to Top 

Secret Information: however, 
il in.iy .1 hn bi Lr.iiurr.il I i"J uti 
eammeKiil tou lief service* 
li well as LfSPS IfUSPSa 
used, only E*p«ess of 
BegislePfd Mail is ipprcnf Bd- 



Ccxifidential nifcrnution miy 
be trill. L*jr ally jnelhod 
approved fir' Secret 
irllbrnutxxi bul jIk) mury be 
sent thnouijii USPS uunc] 
Certified mail o» rtcnil*. Firs! 
Clays, marl , If First Class, mill is 
imd, ft may <mry genu 
mother M.S. Government 
Facility and only to an actual 
iddr«i. 



HSI P-3rjrain Team 
lt-:2W-5M-19B3 

H51_P- .•ytMlTw* ■wl»p..<f* 
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Receiving Classified Information by Mail 



FegardteK of how you receive a docutnenl. either by commer<ial courier service or 
by an agency authorized courier, there are several key markers to indicate (he 
package may contain classified Information. 



Classified m form at ion must be double wrapped, 
with (he 1 1 men envelope milled to indicate the levet 
of classified information that is contained within, 
and will include the name of the recipient. 

ff yog receive a classified document by 
mail or courser and it is not double 
wrapped, immediately contact your NSI 
Reresentatlve or the N5I Program Team. 



■r.rn nlWrJap*. 



The outer envelope will have: 

■ The sender's and reel ptem'saddressss- 

■ NO classification markings. 




Outer * nvc tape. 



Remember Classified information' may 
only be stored in a secure room accredited 
for storage of classified information. 



HSIP-3gr*mT*inm 

Mf^ P' ;iji^J4|TvJ ■ hi |<L.« <J < 
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Knowledge Check 9 



True or False: It is OK to shred classified information at your desk using the strip 
shredder purchased from the office supply catalog. 



True 
• False 



lh:JC-2-SM-19tt3 



Correct - Only NSA approved shredders a re 
authorized for ihe destruction Df classified 
information. These will be located in secure rooms 
accredited lor destruction of classified inrormattciri. If 

you ire unsure whether your shredder Is an MSA 
»ppfovedmrxiel.<cnUCTtheNSiP. CHckhereto 
here to cinntm ue try again. 



dm 



SMI 



1 
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Receiving Classified Information by Mail 



tf you receive a classified document directly, and you were not expecting it, either 
through the mail or from an agency author ized courier, immediately take the 
package to your nearest secure area and notify your NSI Representative. 

If the nearest secure area is located outside EPA 
controlled space and you are not an EPA authorized 
classified courier, immediately contact your NSI 
Representative of the NSI Program Team. 

if you are unsure of where the nearest secure 
area is located or who your NSI Representative is, 
contact the NSI Program Team for assistance. 

No one, regardless of position, has a right to store 
classified information outside an accredited secure 



A 



STOP 



Re mern her. C la ssified i nfo mnation may only be stored i n a 
secure room accredited for storage of classified info rmation. 



t-J!3 gran Tfr?jn 
I't-: 2*2-564-1963 
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Clearance Holder Responsibilities 

As a clearance holder with EPA, you have certain responsibilities above and beyond 
what your un-cleared coworkers may have, These responsibilities include: 

• Complying with all security regulations. 

• Limiting access to classified Information to prevent unauthorized disclosures). 

• Completing the annual NSI security ref resher training. 

■ Reporli rig change 5 in Job position , dull es, retirement, or a p Ian ned departure 
irofn the agency. 

• Reporting teturlty Incidents immediately to your MSI Representative and/or IheNSl 
Program Team, 

■ if reporting cannot be accomplished immediately, report the security incident 
Within 24 hours of discovery to your NSI Representative and/or the NSI Program 
Team. 

Remember Top Secret security clearance holders 
must also report changes in marital status and 
same/oppos ite sex cohabitation. 

NSIP-agrmtTuni 
IKJCO-SM-IWa 
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NSI Security Incident Reporting 

we mentioned previously, part of being a clearance holder is the reporting of possible 
security incidents involving NSI. 

There are two types of MSI related security Incidents: 

®^ 

VldjUomocojr wfien all indnrtdml 
knowingly dLutosH dassifed 
•irforinjlion to jo unaiMrior ised pwnwi 
at pttiUhi; *nyieu<Jrt thatttiuJbln 
Oitiosst-coriipromise- or suspected 
compromise ot dassl&ed infonrortjofli 
or. when an indiyidyjipnTwwnj't 

The NSI Program Team, or an assigned representative, will conduct a preliminary inquiry to 
determine whether an infraction or violation occurred. 



Infractions 
Violations 



bnfrarriuni irr coniidi rod [□ bo in? 
uiinCnrriDnj^vialjIian prircurity 
re^ddWrii Out eta. net typlcily 
Invoke tfw bst, compcDrnjAc, cm 

Mifanuilon. 



H ii the NSI Pittgram Teams responsibility to determine 

whet her an I nlrartkm or Violation has occ u rred. It is your 
msif □tjrrniTmn responsibility to report suspected incidents. 



lt-:JCO-SM-1 383 
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NSI Security Incident Reporting 

The Preliminary Inquiry report is a fact-finding mission and allows the NSI Program 
Team to determine the severity of the incident and recommend appropriate 
corrective actions based on this determination. 



The severity of the 

retsmnvnded jtHons \t 
based on the icrlousncti 
of die incident; whether 
or not t he i ncSividu a ! ha* 
been involved in 
incidents previously, and. 
the time spa n between 
incidents. 




Corrective actions may 
include, but ru)t be 
limFtedto-wntven or oral 
ad monitions; suspension; 
revocation of clearance; 
emplHjyment terntfnrton; 

and/or fines a nd 
Imprisonment. 



The imposition of corrective actions does not 
prohibit or limit actions that may be taken under 
civil cr criminal statutes. 



NaF-aqnnflTwm 

lt-:2K!-5M-l9*J. 
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Knowledge Check 10 



What are the two types of security incidents? 

A) Breach and Violation 
Bl Trflnsgreisiori arid Infraction 
Q Irifririgernent and Misdemeanor 
Di Infraction and Violation 



NaP-agrmtTwrn 
It-rJCO-SfrMWJ 



Cwrrct • The two typei vl jrcurtty ire Iderrti 
«(«■ Infrn-tlcms arwi Violation s. infr ions it* 
tonj«d*ted to betirVnltfuvm.iJ.rn-idrrtH 
whprpij Vinl j*ion-, art' t Gitfc here to 
rnlefiJtona). Cljcih here try again. 
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Quiz 



Now that we've completed the training portion we will move on to the final step, a short 
quiz to test your knowledge of the concepts we covered today. Upon compfetlon, you 
will be given j certificate showing that you completed the course arid passed the quiz. 




WSJP =grjnl Team 
lh:JC-2-3M-19ft3 
N3 P ;gr«uiT*^ **^»ti*'/A 
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Question 1 



From the options below, choose the correct guidance documents that apply 
to ERA'S NSI Program.. 



• A) EO 13526. 32 CFR 2001, and MSI Handbook. 

6} EO 12953, 1500 Implementing Directive, NSI pamphlet, 

Q EO 1 3557. ISOO Marking Guide, and the EPA Information Resource Manual. 

0) None of the above. 



NSF> agrmtTwrn 
H-rJKofrM 303 



Correct - EO 1 352* provUet th* we » rehtng 
guidelines of 1 he MSI Program for the E Kecirtiwe 
braiwh. 1500 hil enpanrfwl upon thow guidelines 
IhtttUflh 32 CfR 200 l-The NSI Handbook cutset 
.in. I .i f jpll« Tr>e guidelines *o the agency and how ft 
conduct; business where classified rrrrbrmatioti is 
invokr4 Click hrrr tocontlrvufc 
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Question 2 



After logging on to the HSDN terminal, the printer starts up and a job sitting in 
the pri nter 's. queue begins to pri nl. What shew Id you do? 

A] Wait for the job to finish printing and then shred it because you don't know who 
printed it or why. 

■ B) wait for the job to finish printing; protect it in a manner appropriate to its 
classification level And notify the secure area manager. 

Q Lu ^ the print Job on the printer after it firtiilies printing, whoever printed it will 
come back for it. 

D) Double wrapt he report and leave it at your co-worker's desk became you know he 
was the last one to use ttiesexure room. 



HSJP ^qrjiHT«m 
l*-:iC-2-oM-19M 



Correct - 'J mil a determination can be made 
regarding tin printed document, it must be pmlectcd 

■n a Tanner appropriate to its classification level. 
Whenever a irialrunctionvnth HSDN or JWICS occurs, 
you must immediately notify the secure area 
manager. Click here tip continue. 



Submit 
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Question 3 



You are holding a meeting in your office, which is not accredited for classified 
discussion, when a participant brings up a classified topic. Do you continue 
the conversation because no one outside your office can hear the discussion 
or do you stop the conversation until you and your party can move to the 
nearest accredited space? 

A) 1 know no one would eavesdrop- outside my door, well just continue the 
conversation, in my office. 

* B) No, 1 would stop the conversation and inform- the participants that we w ill have 
to resume our talkafterl lei my NSI Representative know that we need to 
schedule a meeting in the secure area and she has confirmed the clearance 
level of all participants " ' ' "' ^ ' : ' " " "' : " ' v ' nn 

C) It depends on whether we actually talK^M^lMffHtlrVg ttafe4ifWft ^ '* , ln ^ ,cl "' ■"' 

urwecurr location. Hall the conversation and ntuheduU; 
t be meeting jo it can be held in the secure room. Yen 
must notify your NSI Representative In advance of the 
meeting and provide names of who will be attending 10 
that they can confirm clearance Itveli of the partidpajits, 
CSck hereto continue. 



D} None of the above?. 



fJSJP ^HIMHI NNOTI 
ir-:iCO-=M-l'3ts3 



CitM 
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Question 4 



Your NSI Representative developed a Standard Operating Procedure {SOP} for 
the local secure room. The 50P clearly indicates that reproduction of classified 
information is not authorized in the secure space. However, you notice an 
all m pup prints has been placed in the room to use as a copier. Should you 
mention this to your NSI Representative? 

A} l think nny NSI Representative put the all-in-one printer in the ream just to see 
if anyone read the SOP; I am mot going to ijse it bitt I also won t men tmn thr.t I 
saw it in there. 

• Bf Yes. lam not sure who put the all rn-one printer in the room but it is not an 

authorised piece of equipment and my NSI Repfesehtative should know that rt 
isthere- 

C) No. I do not want my NSI Representative to think I put the all-in-one printer in the 

fcXrffl. 



Di Y*4. Because it's in. the zoom and I want wmbk&'irfitftffl 



i of ia '- wntallve If you are 



classified report. It will be easier todo t^rt■tKa^Ji(V^n^nVp|r1^(ter i m^Wlh^ , '' ' 11 ■' : '""' r 
copier near my desk rtlMW W tovdttadaisinid lrtfBmi«Ujn.Qnl]r 

authorized cqutpment may be instated and uyni within 
a secure room . CJlck hen? tD continue. 



NSI P^qrjm Turn 
i>:iM-aM-V303 
H3_P- vy^^ir^j -fci^Li* i>.h 



•- : jfc-:i! ' 
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Question 5 



Choose the correct set of items that can be used to identify an 
authorized security container. 




Mm 



lr-:2C-2-SM-l963 



■ r ■ 

ft w> win ■ 
MO** 




E 




Correct - AH tecunty cottfrlrwi *uttw*«l (c (ton- 
classified mfcHrrutlo-n will be located in secure rooms 
tnti most hav*« GSA authorliadon slicker nor ihe finin 
of the container: a hkjh lecurity digital lock or locks; and, 

each dfaWcr wlh .1 lock muil hart li jown Security 
Gcntabier Ghee ksheeMSF 702> aft™** CHicJt here to 
die container, clnk krrr to i try again. 



Our 



.-jlviv 
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Question 6 

Choose the form that should be completed at the end of the day if 
you have conducted work in your secure area and/or accessed your 
security container. 



;;L,.'.- 

Tipj.i 



lt-:3M-5M-1 K3 



— r . ■ r.i ., — ■ i. 





Correct - The Activity Security Checklist (SF 701) must be 

completed rt ihf end crihe d.*v •< I ■. my 

container. If the secure room arid security container l> 
accessed intermittently, the SF 701 would be completed 

each day ' he container .5 accessed, the SF 701 mav be 
used; as a single sheet with the fulrdate Click here to , 
of the time checked . Cli ck hore < tryagain. 



::v : .,i> 



1 
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Question 7 



A co-worker has access to the security container in your secure room; 
however, she is retiring at the end of the month. Do you have to change the 
combination to the security container once she is debriefed and no longer 
requires access? 



A) Ho. Once she is debriefed she will not be allowed into the secure room. 

6) No. She is retiring. S he wil I no longer be able to a ccess the bu i Iding without an 
E PASS ID. 

• C) Yes. She no longer requires access to the security container, the combination must 
be changed. 

D) No. She said that she does not remember what the combination was so the 
security container should be OK. 



Correct - Combinations to security containers and secure 
rooms must be changed when an individual with access no 

longer requires it as part of their duties. Once the 
co-worker has been debriefed, the combination^ must be 
changed. Click hereto continue. 



H3 P~=gr.?m Tean 
rhr2*2-5«4-l-SB3 
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Question 8 

A courier from another agency delivers a package to you personally, When, 
you open the package, you find a second envelope inside. The inner envelope 
is stamped SECRET at the top and bottom of the envelope and on both sides, 
Do you continue to open the second envelope, knowing your office is not 
accredited for classified operations? 

• A) No. As swn as I see the inner envelope ta marked, regartlfess of the 
classification level, I take it to the nearest room accredited for classified 
storage at that level, in am unsure of the location or it is outside EPA 
control l-ed space, I will contact my NSI Representative or the NSI Program 
Team. 

Copfjjrt - Regardless oi haw the package is received, do not open 
6> Yes. and then I will put it in my sjesk. ^Etd Js^yhur^.^.ft^.h^HWSlUlSiMfjre location II 
office, It will be safe, yojj are not anEPAautlinnied courier, ytvu must notify your Nil 

C) Ye*, I am sure the markings arfi'ifffiai^ 
the document ja darted. C* Jo ™« 4rfa ff .r* tiffulde EW 

rtiritriilW ip»(e. CUwhid information nuist be protected at ill 

D) No, I will put it in my desk aTld^o*il^l^W^^flV*^ll(^^^*^»*t^^l^qflll^■ cqihi>'u? 
to the secure «oo m to review MOnllltirikMlk&eAlW*" "* « ^rMhetucJuge 

\n*n approved i« w ity conuirter. Click here to < ontJnu*, 



ItrJtO-oM-l 303 

H3 P- vij^<|Tw j ■ vt w\m *ys 
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Asa Top Secret clearance holder, are you required to report, to the MSI 
Program Team, that you have recently moved in with your significant other? 

A) No. It's private a r>d rwone needs to know that we are living together. 

B) Yes. I want everyone to know we have taken the next step in our relationship, 

C) No. N o one cares about who I live with. 

* D) Yes. I must report changes in cohabitation. 



Correct - Because of the sensitivity associated wrth Top 
Secret Information, personnel with access to that level of 
classified information are required to report additional 
information that may not be required of Secret level 
clearance holders. Or>e of the reporting requirements is 
cohabitation, regardless of the cohabitant's gender or 
relationship to the clearance holder Click here to 
continue 



l1*:2C2-5«-19B3 



Clear 



&jbmn 
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Question 10 



You have work to do on a classified report. When you enter the secure room, 
you notice that one of the drawers in the security container has been left open 
though the loom itself was secure. Normally the security container is secured 
as the room Is not accredited for open storage, To whom should you report 
this incident? 



A) The room was secure; no one has to know thattlte drawer was left open- 1 will 
dose it after I finish my work and quietly mention to my co-worker that he 
needs to he more- careful next time. 

B) My MSI Representative. She will know how to handle this and what the next 
steps are. 

iGMrert A» • tlwwancc holtta, orw cl • 
Q The NSI Program Team. They will ki^^^.-tq^fl^^J^frrrVm.^k* 



D) Both E and C are correct. 



N5IP jijrjmT«jm 
I l-r 202-5M-1 9413 



■■ ■:{:>.■ mIjiI'Iuv. i. 

f&flSMftS^Pft? living 
the- (J/,iwfr of » ^cifTlty coti(«ifne* open, whtn it ihguld l*r 
seaji*d, evrrt though the oW to (he Krcuwroam ha» b*rn 
tock*d constitutes a wjcurity Incident The tlfcumstances 
sunounding why/fiDW the incident occurred must be 
mmlried. Iltirt wdialdy report the incident to your N5I 
RBprcientJtlve andJm the NSI Program Team. Cftck here to 
continuE. 



Oar | [ 
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The information below supplements the 2013 National Security Information annual training in 
compliance with requirements specified in 32 CFR 2001 Classified National Security Information. 

Handling Other Agencies' Materials or Foreign Government Information 

At a minimum, all safeguarding and protection requirements identified for the handling of EPA 
classified information must also be met for classified information generated by and provided to the 
EPA on behalf of other agencies. Dissemination of other agency materials is allowed if authorized by 
the owning agency but may be restricted or prohibited. Handling limiters may be included with the 
information or provided by the owning agency at the time of transfer. In all cases, refer to the owning 
agency's point of contact for clarification. 

In addition to the above guidelines, the following must be applied to foreign government information 
(FGI): 

Store separately from NSI to ensure on-going protection of the information. This separation 
may be accomplished by use of separate drawers in a multi-drawer/multi-lock safe. 

- Top Secret and Secret FGI must be recorded on a drawer inventory log with a receipt of 
transmission and/or destruction kept as part of the record, in addition to specific handling 
requirements identified by the country of origin. 

Reproduction and release of FGI is strictly prohibited, unless expressly granted by the country 
of origin. 

- The recipient of FGI is responsible for ensuring an equivalent degree of protection as required 
by the country of origin. 

If safeguarding requirements are lower than those required for equivalent US confidential 
information, then the FGI will be re-marked in the following manner: This document contains 
(insert name of country) information to be treated as US (insert classification level). 

Threats and Techniques Employed to Obtain NSI and Penalties for Engaging in Espionage 

Foreign intelligence agencies and their agents are motivated to collect classified information in any 
way possible. These techniques may include: 

Spying on and blackmailing suspected/known clearance holders or other persons of interest 
Surreptitious monitoring of computer access and electronic data collection 
Exploitation of personal relationships 

Aiding unauthorized persons in the collection of classified information is considered espionage. Spies 
may be charged with espionage, theft, computer fraud, and aiding the enemy among other charges. 
Each charge carries its own minimum term and fines, any combination of which may be applied to the 
convicted individual. If you suspect you are under surveillance or have been approached by a 
suspicious individual, report the contact to the NSI Program Team immediately. 



